What Skudo can hand over when a court orders it
BlogExplainer
An alias service cannot promise what it does not hold, and it cannot hide what it does. So here is the list. I run Skudo alone, as a private individual in Italy, and that shapes the answers.
In short
- Skudo holds the alias in plain text and the forwarding address encrypted. It decrypts that address at every delivery, so a valid order can make it produce it.
- Message content is not archived, and most operational records last 7 days.
- There is one operator in one country. Nobody else could refuse on your behalf.
- Nothing has been counted yet: no quarterly reporting period has closed.
What is stored
| Record | Form | How long |
|---|---|---|
The alias, shop@skudo.me | Plain text, so the relay can route mail | Until you delete it |
| The address it forwards to | Encrypted, with a keyed index | Until you remove it |
| Alias note and display name | Encrypted | Until you delete the alias |
| Counters and last-used time | Plain | Until you delete the alias |
| Records of messages sent through the alias | References and type, no content | 7 days |
| Delivery failures | Sender and destination encrypted | 7 days |
| Encrypted backups | Nightly, off site in the EU, with one key per user | Until you delete the account: then the key is destroyed |
Abuse and legal-order records last 24 months. The full list is in the privacy notice and the architecture page.[4][1] The cipher is AES-256-CBC with an HMAC-SHA256.
What a valid order can reach
The forwarding address is encrypted, but decrypted at every delivery, so the key is on the running machines. With a valid order, Skudo can decrypt it. The architecture page says there is no second party to ask.[1] A copy of the database alone does not reveal where anything forwards.
When an order arrives
Requests go to legal@skudo.org and must state the legal basis, the authority, the addresses and the period.
- Review. The order is checked against its law. Defective orders, or ones from an authority without jurisdiction, are refused and where possible contested.
- Production. What I hold is produced. If the order demands the forwarding address, it is decrypted.
- Notice. You are told before disclosure where possible, and afterwards where not, unless the law forbids it.
- Counting. A quarterly report gives six figures, and a zero is printed as zero.[2]
No period has closed yet, so there are no numbers. A gag order could stop me naming the requester. What stays visible is the count and the canary. I am one operator in one country, as the requests page says.[3]
What stays out of reach
- Message content is not archived. If your inbox is unreachable, a message waits in the mail queue until it is delivered or expires.
- The optional mailbox is off by default. When on, it stores only mail encrypted to your OpenPGP key, or already encrypted end to end.
- Donations are not linked to accounts.
What this does not protect against
- Traffic analysis by someone watching both ends.
- Your own inbox provider.
- Compulsion against you.
- Skudo itself: a valid order, or an attacker who takes the running system.
There has been no external audit. If I commission one, the report will be published in full. Use a different alias for every site, add your own domain, and upload an OpenPGP key if you use the mailbox.
Sources
Statements about Skudo come from these pages of this site and from how the service is run, checked on 19 September 2026.
- Architecture of the encrypted mapping: https://skudo.org/security/architecture/ ↑
- Transparency report and canary: https://skudo.org/transparency/ ↑
- Guidelines for law enforcement: https://skudo.org/legal/requests/ ↑
- Privacy notice: https://skudo.org/legal/privacy/ ↑